What is CVE-2019-19135?

CVE-2019-19135 is a high-severity vulnerability in Opcfoundation Netstandard.opc.ua, classified under Use of Insufficiently Random Values. CVSS score: 7.4/10. Published 2020-03-16.

How severe is CVE-2019-19135?

High severity. CVSS v3 base score is 7.4 out of 10.

Vulnerability in Opcfoundation Netstandard.opc.ua

CVE-2019-19135

In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentia…

EPSS: 0.010 (59.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Opcfoundation Netstandard.opc.ua
Opcfoundation Ua-.netstandard — versions 1.4.357.28
N/a — versions n/a

Weakness classification (CWE)

CWE-330 — Use of Insufficiently Random Values

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2019-19135?: CVE-2019-19135 is a high-severity vulnerability in Opcfoundation Netstandard.opc.ua, classified under Use of Insufficiently Random Values. CVSS score: 7.4/10. Published 2020-03-16.
How severe is CVE-2019-19135?: High severity. CVSS v3 base score is 7.4 out of 10.